PT-2011-1176 · Gentoo Linux+1 · Quagga+1

Jan Lieskovsky · Published 2011-03-29 · Updated 2024-06-15 · CVE-2010-1675

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Quagga versions prior to 0.99.20 Quagga versions prior to 0.99.18

Description The issue affects the quagga package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely. Specifically, a malformed AS PATHLIMIT path attribute can cause a denial of service (session reset) in bgpd.

Recommendations For Quagga versions prior to 0.99.20, update to version 0.99.20 or later to resolve the issue. For Quagga versions prior to 0.99.18, update to version 0.99.18 or later to prevent a denial of service (session reset) via a malformed AS PATHLIMIT path attribute.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09430

CVE-2010-1675

DSA-2197-1

OPENSUSE-SU-2024:10362-1

RHSA-2011:0406

RHSA-2011_0406

Affected Products

Quagga

Red Hat

References · 27

• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10362-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1675 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:058 · Vendor Advisory
• http://secunia.com/advisories/43499 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09430 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-0406.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2197 · Vendor Advisory
• http://secunia.com/advisories/43770 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0711 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201202-02.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html · Vendor Advisory
• http://securityfocus.com/bid/46943 · Note
• https://access.redhat.com/security/cve/CVE-2010-1675 · Note
• http://osvdb.org/71258 · Note